Compliance & Audit Log

Scope: Audit trails, compliance control implementation, and automated compliance checks. For GDPR-specific data subject rights and consent management, see gdpr-privacy. For access control and authentication patterns, see auth-patterns and security-review.

When to Activate

• Designing an audit log for a sensitive feature (admin actions, PII access, financial transactions)
• Preparing for SOC 2 Type II audit
• Implementing HIPAA, PCI-DSS, or ISO 27001 controls
• Adding access control review / privileged action logging
• Setting up compliance checks in CI/CD
• Responding to a compliance audit request (evidence gathering)

Audit Log Design